Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to make my Debian server the router for my LAN.

I got two interfaces: eth0 connects to internet through PPPoE, eth1 to LAN. I switched on forwarding in sysctl net.ipv4.ip_forward=1 and disabled iptables(policy accept). I can ping the gateway, but can't ping anything on the internet.

share|improve this question
up vote 3 down vote accepted

You need to use NAT to share the internet connection to your LAN.


iptables --table nat --append POSTROUTING --out-interface eth0 -j MASQUERADE
iptables --append FORWARD --in-interface eth1 -j ACCEPT

See this guide at HowtoForge for more info:

share|improve this answer
I thought when iptables disabled there are no barriers to traffic.thanks i'll try it – 29ru Oct 19 '11 at 10:31

Enabling IP forwarding (AKA routing) is not enough; you must also NAT the internal network to the external IP.

Disabling netfilter is not going to get you there; you need Rusty's one-line rule of masquerade:

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.